0

I asked a question about the fuser command yesterday here. It seems gedit (and other text editors, and perhaps even other processes) act a bit differently in the way they interact with files, so they don't show up on when calling fuser even though they have opened a file.

I would like to monitor a file for ANY process which accesses it, whether it keeps it open or not. Is there an alternative command / software which I might be able to use for this purpose please? This can include from languages such as python as well.

Thanks for reading.

Community
  • 1
  • 1
Mustafa Doe
  • 125
  • 1
  • 2
  • 7
  • 1
    `fuser` can't show files that was opened, read and closed till moment of its run! It seems that `gedit` don't keep files opened. Check yourself: open some files in gedit, then run `lsof|grep gedit`. BTW, to see all files opened by process with some PID, run `ls -l /proc/PID/fd`. – Eddy_Em Jun 19 '13 at 15:39

1 Answers1

1

If a file is not open then it's not being accessed. If what you want is to keep track of who opens what, then you need to setup an auditing tool like auditd.

rectummelancolique
  • 2,247
  • 17
  • 13